00:19:13 · Tracy Alloway, Thai Duong, Joe Weisenthal, S1
[00:19:13] S3: So just to be clear, the use of AI in all of this, it wasn't necessarily that important in finding the vulnerability. It was more important in developing an actual exploit for a known issue. [00:19:27] S4: We think like that's probably the right way to think about it. But I think even for finding the vulnerability without AI, it would take a lot more time, right? So you can imagine like PHP was created like maybe 30 years ago. So it's a huge code base with a lot of features. And as a human engineer, you have to dig into this code base and it will take like months, right? And along the way, people may give up. But the fact that PHP Foundation filed the bug in 2024 proved that humans can actually file the bugs, right? And the problem was the exploitation, like you said. And for exploitation, like AI plays a major role in it. It's like becomes an engineering problem where our engineers would tell AI, you know, this is how I want to design our exploit and you go and do it. And then, you know, prove to us that it works correctly. Yeah. [00:20:31] S0: Let me ask a philosophical question. Is there a reason to believe that defensive cybersecurity can stay ahead of offensive cybersecurity, just generally, and then we can get into some details. But philosophically, is that something that we can reasonably hope for? [00:20:49] S1: I think so, yes. [00:20:50] S0: How come?
00:20:50 · Joe Weisenthal, Bruce Dang, S1, Thai Duong, Tracy Alloway
[00:20:50] S0: How come? [00:20:51] S2: Because you can use the AI to build certain types of systems in ways that may be very challenging. for attackers to exploit. Today, you can use AI to build whatever systems you want very quickly. You can experiment, get feedback very quickly. It can also process data very, very quickly and reason about that data. [00:21:19] S1: And so I think it is possible. [00:21:22] S2: I think it may not be immediate, but over time, we're going to perhaps use AI to help us write more secure software or build more secure systems. And eventually, I think that should counterbalance the advantages. [00:21:40] S1: That the attackers have. Perhaps I'm being optimistic, but I do foresee this happening. [00:21:47] S4: I can add something there. So if you look at the history of humanity, our history is the history of like weaponize our tools, right? If you find a powerful tool, then someone would find a way to use that tool as a weapon. [00:22:03] S3: Yeah.
00:22:03 · Tracy Alloway, Thai Duong
[00:22:03] S3: Yeah. [00:22:04] S4: So, and attackers always are early adopters of tools, right? New technology. Defenders move like at much slower pace than attackers. But fundamentally, we believe there are more good guys than bad guys out there. And eventually, the good guys would catch up and build things that help everybody defend off the bad guys. And I don't think in general, cybersecurity, if you see the news all the time, you see we got data breach every day almost, even before AI. So you may feel like it's not working at all. But if you're in the field, you can see the progress, right? In the past, like, 25 years, there's a tremendous progress in cybersecurity. Of course, people still got hacked because this is difficult. Imagine you have a very complex system. Like, imagine you have a house with lots of doors and lots of ways to get in. And cybersecurity must, like, make sure that everything is safe. At the same time, your house or your Office must remain open for business. So it's actually a pretty difficult problem. At the same time, without the progress that the industry made in the past 25 years, things could be much worse. And I think the same thing would be happening here. It's going to take a while for defenders to catch up. Right now, AI helps attackers more than defenders.
00:23:41 · Tracy Alloway, Joe Weisenthal, Thai Duong, S1
[00:23:41] S3: Is the general idea that we're just in this sort of awkward phase where a lot of people in cybersecurity always refer to technical debt, right? This idea that you haven't upgraded a system for ages, like the PHP vulnerability we were just discussing, and so now you have to pay back that technical debt. The idea that we're just in an awkward moment where AI is going to be able to exploit existing flaws in the system is But maybe we eventually move to a place where we upgrade the entire system. [00:24:13] S0: We reduce our outstanding technical debt. [00:24:14] S3: We reduce the outstanding technical debt. Exactly. [00:24:17] S4: That's an optimistic way to look at it. [00:24:19] S1: Okay.
00:24:20 · Thai Duong
[00:24:20] S4: You know, we found that there are systems that we thought that, okay, that don't have a lot of technical debt. That turned out that they just like dumpster fire like everybody else. That was a very big surprise to me personally. We know there are places, there are bad problems, and we know that if we just point AI at that thing, there will be a lot of bugs coming out. But there are also places we thought that could be okay because they received a lot of attention over the years already. But it turns out that there's still a lot of bugs there as well. And a lot means a lot more, like 10x more than we expected. And of course there are still like a few small places where there was fewer bugs back then before AI. Now there's still fewer bugs still now, but they're like very small, like very like lit, like they are the exception, not the norms. So that's actually a big surprise because I don't think anybody was surprised to find a critical vulnerability in PHP. because PHP wasn't known for like race security. So of course at the PHP 2.0 scale, then that's a different matter. But if you find another vulnerability in PHP today, then that's not a surprise. But if you go and, you know, find a vulnerability or maybe a hundred vulnerabilities, a thousand vulnerabilities in the Chrome browser for example, that's a surprise. And that's exactly what happened. Like people found like a thousand vulnerabilities in Chrome and you know, I was at Google and I knew, and then the entire industry like assumed that and knew that, wow, there was a lot of investment in Chrome security. And not just like, you know, remove, like eliminate vulnerabilities, but making sure that even if you have vulnerabilities, it's difficult to exploit these vulnerabilities. This is what we call mitigations. You accept that you have vulnerabilities, but then you make sure that like attackers couldn't use these vulnerabilities to control your computer or your browser. We thought that, you know, the defense layers were pretty good and the rate of vulnerabilities were low. But then after AI, we just discovered that either like we, as security engineers, suck at our job. We couldn't find these things. Or they're just like too much code that we didn't have enough time to look into.
00:27:03 · Joe Weisenthal, S1, Bruce Dang, Tracy Alloway
[00:27:03] S0: So this raises another question. Like, is it possible to have a provably secure browser or a piece of software? You ship the piece of software and you can prove maybe in the same way that mathematicians produce things and this thing called lean or whatever. Does cyber have an equivalent where you could say, This is provably secure. And we know that no matter how good AI gets, it will never find a vulnerability in this piece of software. [00:27:32] S1: Oh, man, this is a loaded question, Joe. [00:27:36] S0: I thought it was a simple question. [00:27:38] S1: Yeah. [00:27:39] S2: I don't know, to be honest, you know, like browsers are like, you know, its own operating system, like very, very complex operating systems. Yeah. And today doing, you know, like formally verified software, you know, like it doesn't work at that scale. It's typically smaller, smaller software components. [00:27:58] S0: So there is such thing as formal verification when it comes to software. [00:28:03] S2: Yes. [00:28:03] S0: You could have small piece of software in which you formally prove in the same way that It takes mathematicians seven lines to prove the two plus two equals four. There is some sort of equivalent for software where you can prove these lines of code are secure, but the question is the scale of even something like a browser is just so enormous. That's a very difficult thing to do. [00:28:29] S3: Yes.